CVE-2026-35366
Last modified
CVE-2026-35366 is a medium-severity vulnerability rated 4.4/10 on the CVSS scale. The printenv utility in uutils coreutils fails to display environment variables containing invalid UTF-8 byte sequences. While POSIX permits arbitrary bytes in environment strings, the uutils implementation silently skips these entries rather than printing the raw bytes. EPSS estimates a 0.17% chance of exploitation in the next 30 days.
Description
The printenv utility in uutils coreutils fails to display environment variables containing invalid UTF-8 byte sequences. While POSIX permits arbitrary bytes in environment strings, the uutils implementation silently skips these entries rather than printing the raw bytes. This vulnerability allows malicious environment variables (e.g., adversarial LD_PRELOAD values) to evade inspection by administrators or security auditing tools, potentially allowing library injection or other environment-based attacks to go undetected.
Metrics
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Uutils | Coreutils | < 0.6.0 |
References
- https://github.com/uutils/coreutils/issues/9701Exploit, Issue Tracking
- https://github.com/uutils/coreutils/pull/9728Issue Tracking, Patch
- https://github.com/uutils/coreutils/issues/9701Exploit, Issue Tracking
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-35366?
How severe is CVE-2026-35366?
How do I fix CVE-2026-35366?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-35360The touch utility in uutils coreutils is vulnerable to a Tim…6.3
- CVE-2026-35361The mknod utility in uutils coreutils fails to handle securi…4.4
- CVE-2026-35362The safe_traversal module in uutils coreutils, which provide…3.6
- CVE-2026-35363A vulnerability in the rm utility of uutils coreutils allows…5.6
- CVE-2026-35364A Time-of-Check to Time-of-Use (TOCTOU) race condition exist…6.3
- CVE-2026-35365The mv utility in uutils coreutils improperly handles direct…6.6
- CVE-2026-35367The nohup utility in uutils coreutils creates its default ou…3.3
- CVE-2026-35368A vulnerability exists in the chroot utility of uutils coreu…7.8
- CVE-2026-35369An argument parsing error in the kill utility of uutils core…5.5
- CVE-2026-3537Object lifecycle issue in PowerVR in Google Chrome on Androi…8.8
- CVE-2026-35370The id utility in uutils coreutils miscalculates the groups=…4.4
- CVE-2026-35371The id utility in uutils coreutils exhibits incorrect behavi…3.3
Are you affected by CVE-2026-35366?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST